94021cc305 — curl

Subject

tests: Test certificates with embedded zero bytes

No binary (build failed)

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

(log yok)

tests/http/test_17_ssl_use.py+26 -0

@@ -598,3 +598,29 @@ class TestSSLUse:
	])
	# CURLE_PEER_FAILED_VERIFICATION or CURLE_SSL_CACERT_BADFILE
	assert r.exit_code in [60, 77], f'{r.dump_logs()}'
+
+	@pytest.mark.parametrize("proto", Env.http_protos())
+	def test_17_23_embedded_zero(self, env: Env, proto, httpd, nghttpx):
+	httpd.set_domain1_cred_name('embedded-zero')
+	httpd.reload_if_config_changed()
+	if proto == 'h3':
+	nghttpx.set_cred_name('embedded-zero')
+	nghttpx.reload_if_config_changed()
+	curl = CurlClient(env=env)
+	url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+	r = curl.http_get(url=url, alpn_proto=proto)
+	# CURLE_SSL_CONNECT_ERROR or CURLE_PEER_FAILED_VERIFICATION
+	assert r.exit_code in [35, 60], f'{r.dump_logs()}'
+
+	@pytest.mark.parametrize("proto", Env.http_protos())
+	def test_17_24_embedded_zero_wildcard(self, env: Env, proto, httpd, nghttpx):
+	httpd.set_domain1_cred_name('embedded-zero-wildcard')
+	httpd.reload_if_config_changed()
+	if proto == 'h3':
+	nghttpx.set_cred_name('embedded-zero-wildcard')
+	nghttpx.reload_if_config_changed()
+	curl = CurlClient(env=env)
+	url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+	r = curl.http_get(url=url, alpn_proto=proto)
+	# CURLE_SSL_CONNECT_ERROR or CURLE_PEER_FAILED_VERIFICATION
+	assert r.exit_code in [35, 60], f'{r.dump_logs()}'

tests/http/testenv/env.py+10 -0

@@ -218,6 +218,16 @@ class EnvConfig:
	CertificateSpec(name="user1", client=True),
	],
	),
+	CertificateSpec(
+	name='embedded-zero',
+	domains=[f'{self.domain1}\0actually.{self.domain2}'],
+	key_type='rsa2048',
+	),
+	CertificateSpec(
+	name='embedded-zero-wildcard',
+	domains=[f'*.{self.tld}\0actually.{self.domain2}'],
+	key_type='rsa2048',
+	),
	]

	self.openssl = "openssl"